• 1 Post
  • 110 Comments
Joined 1 year ago
cake
Cake day: July 14th, 2023

help-circle




  • What exactly are you trusting a cert provider with and what are the security implications?

    End users trust the cert provider. The cert provider has a process that they use to determine if they can trust you.

    What attack vectors do you open yourself up to when trusting a certificate authority with your websites’ certificates?

    You’re not really trusting them with your certificates. You don’t give them your private key or anything like that, and the certs are visible to anyone navigating to your website.

    Your new vulnerabilities are basically limited to what you do for them - any changes you make to your domain’s DNS config, or anything you host, etc. - and depend on that introducing a vulnerability of its own. You also open a new phishing attack vector, where someone might contact you, posing as the certificate authority, and ask you to make a change that would introduce a vulnerability.

    In what way could it benefit security and/or privacy to utilize a paid service?

    For most use cases, as far as I know, it doesn’t.

    LetsEncrypt doesn’t offer EV or OV certificates, which you may need for your use case. However, these are mostly relevant at the enterprise level. Maybe you have a storefront and want an EV cert?

    LetsEncrypt also only offers community support, and if you set something up wrong you could be less secure.

    Other CAs may offer services that enhance privacy and security, as well, like scanning your site to confirm your config is sound… but the core offering isn’t really going to be different (aside from LE having intentionally short renewal periods), and theoretically you could get those same services from a different vendor.




  • The purpose of slang is to signal group identity.

    That’s a purpose of slang, not its only purpose.

    Slang can also be more efficient (“cringe” is one syllable; “cringe-worthy” is three) and it contributes to the evolution of language, leading some terms - like “cringe” to become more mainstream and to see use outside of the group that popularized them.

    Besides, Gen Z might have come up with “cringe,” but millennials were practicing nounification, verbification, and adjectification when Gen Z was still learning to talk, and that’s all “cringe” as an adjective is.

    to my ear, calling something “cringe” sounds like something kids say, because mostly in my everyday life, I only hear children saying it like it made up a fair chunk of their entire vocabulary.

    The oldest Gen Z-ers are 27 and the youngest are 12, so almost none of them are “kids” anymore - they’re teens and adults. But there’s also a difference between using slang on the internet and in in-person contexts, particularly more formal ones. Slang that’s common in one group might not be in another group in the same age range, even if they’re geographically similar. But even so, I’ve heard millennials use (and over-use) “cringe” in public and in private.

    When a GenXer or old Millennial use it, it can come across as either affected or immature.

    A 6 year old in 1994 would have been born in 1988, which is right in the middle of the millennial range (1981-1996), meaning they wouldn’t be an “old Millennial.” But even if they were born in ‘81, my opinion wouldn’t change. Focusing too much on who “should” use a term like “cringe,” especially online, isn’t at all productive, and isn’t very different from telling someone they’re not a big enough fan to wear a t-shirt or to cosplay as a character they think is cool. They’re both just gatekeeping, plain and simple.




  • Each credit reporting agency offers this option, at no charge …

    It is highly recommended to lock your credit. Frankly, it should be locked by default. In September of 2017, Equifax announced a data breach that exposed the personal information of 147 million people.

    Note that, before this incident, it wasn’t consistently free. I remember it being free to lock, but costing $20 or so to unlock. A law passed in 2018 required credit bureaus to offer freezes and unfreezes (and to fulfill them within certain time frames) for free.

    Also note that you might need to look for a “freeze” instead of a lock. Experian charges $25/month for their “CreditLock” service, for example, but they offer a free security freeze.







  • Traction control and other related features is a bigger deal than AWD in my opinion. In the past five years I’ve had AWD engage maybe twice.

    Also, you can replace two tires at once as opposed to all four, depending on the specific vehicle and how much the difference will be between the tires you’re keeping and getting rid of. You only need to replace all four if the difference is enough to cause issues.

    There are a ton of crossover SUVs with FWD, though. Here are a few:

    • Honda CR-V
    • Toyota RAV4
    • Lexus RX 350
    • Toyota Highlander
    • Hyundai Tucson
    • Hyundai Palisade
    • Kia Telluride
    • Nissan Kicks
    • Nissan Rogue
    • Nissan Murano



  • But being rude and abusive to support staff doesn’t help, encourage, or even compel the support staff do their jobs any better or faster. In fact, I’d wager it’s rather the opposite.

    I work in IT (not IT support, though) and I’m fortunate enough that none of my business partners are outright abusive. Even so, I still have some that I deprioritize compared to others because working with them is a pain (things like asking for project proposals to solve X problem and never having money to fund them). If someone was actively rude to me when I had fucked up, much less when I was doing a great job, I can guarantee I wouldn’t work any better or faster when it was for them.